CVE-2026-41154
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
A vulnerability in the sparse memory implementation of GPU drivers allows out-of-bounds (OOB) kernel memory reads or writes. The flaw occurs when indexing pages larger than 4 kB in the page freeing logic, leading to incorrect buffer access.
Risk Assessment
An attacker with non-privileged access can exploit this vulnerability to escalate privileges or destabilize the system by corrupting kernel memory.
Recommendation
Immediately update GPU drivers to a version containing the fix that corrects the indexing error in the sparse memory page freeing logic.
Other vulnerabilities in GPU drivers
See all- CVE-2026-16280Critical
In GPU drivers, an integer overflow when calculating physical offsets for sparse PMRs may cause 32-bit truncation for PMRs larger than 4 GB, leading to incorrect GPU MMU mappings and potential access to unintended physical memory.
- CVE-2025-58410High
Software installed and run as a non-privileged user may conduct improper GPU system calls to gain write permissions to memory buffers exported as read-only. This is caused by improper handling of the memory protections for the buffer resource.
Original NVD description (English source)
Software installed and run as a non-privileged user may cause OOB kernel memory reads or writes through GPU API calls. When indexing pages larger than 4kB in the page freeing logic of the sparse memory implementation, incorrect buffer indexing leads to OOB access.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS